Coverage · 4 min read
The Cyber Protection Gap, and How to Close It
Most Canadian businesses are carrying a gap they do not know about. Their regular policies were built for the physical world, and cyber walked in through a door those policies do not cover.
What the gap actually is
Your commercial general liability, property, and package policies were written around physical risks. Fire, theft, injury, a truck through the front window. They were not written for a hacker in your email or ransomware on your servers, and most of them exclude those events. So when a cyber incident hits, a lot of owners find out the hard way that nothing responds. That space between the risk you carry and the coverage you hold is the gap.
Why it keeps getting wider
Two things pull the gap open. Your exposure keeps growing, because more of your business runs online every year. And the attacks keep getting cheaper and more automated. Meanwhile the traditional policies have not changed to cover any of it. The Canadian Centre for Cyber Security has been clear that attacks on small and medium businesses keep climbing. The risk moves. The old coverage does not.
How a cyber policy closes it
A dedicated cyber policy is built for the way attacks actually happen. It covers both sides of an incident. Your own costs, like data recovery, lost income, and extortion payments. And your liability to others, like customers or partners whose data was exposed. Good policies also come with a response team on call, forensics, legal, and breach notification, so you are not figuring it out alone at 2 a.m.
The takeaway
- Your regular policies almost certainly exclude cyber. Do not assume you are covered.
- The gap is the space between your real cyber risk and what you actually carry.
- A dedicated cyber policy, sized to your risk and paired with basic controls like MFA, backups, and training, closes it.
Frequently asked questions
What is the cyber protection gap?
It is the difference between your real cyber exposure and the coverage you actually hold. A lot of businesses assume their existing policies respond to a breach. Most do not.
Do traditional business policies cover cyber attacks?
Usually not. Property, liability, and package policies are built around physical risks and typically exclude cyber events.
How do Canadian businesses close the gap?
With a dedicated cyber policy sized to their actual risk, paired with basic controls like MFA, backups, and staff training.
Not sure where your coverage stands?
Run the free Coverage Assessment, or book a no-pressure review and I'll read your actual policy and tell you exactly where the gaps are.
By J.R. Genua, CCIS, Certified Cyber Insurance Specialist and Registered Insurance Broker. Insurance services provided by St. Andrews Insurance Brokers Ltd.